Shadow AI: When Staff Paste Secrets Into a Chatbot

The 30-second explanation

Someone wants to summarise a contract or debug some code and pastes it into a public chatbot. The data has now left the company, without anyone meaning any harm.

How it works

1. 1

   1. Need

   Someone wants help with a task.

2. 2

   2. Paste

   Data is entered into an unapproved tool.

3. 3

   3. Leave

   The content is now outside company control.

4. 4

   4. Consequence

   Exposure, compliance or contractual issues.

People adopt AI tools because they are useful. If the approved option is missing or awkward, they use whatever works. The risk is not the tool itself, but what is submitted: customer data, source code, credentials, incident details. Once entered into an external service, the organisation may not control how it is stored or used. The fix is a mix of approved tools that are easy to use, clear rules on what may be shared, and technical controls for the most sensitive data.

Real-world example

How to spot it

• Traffic to unapproved AI sites

  Frequent use of consumer chatbots from work devices.

• Data pasted without review

  Files or logs copied into prompts.

• No approved alternative

  Staff have nothing sanctioned that does the job.

• Unclear rules

  People unsure what they may share.

What to do

1. 1Provide an approved AI tool that is easy to use, so people do not go looking for others.
2. 2Publish simple rules: never paste credentials, personal data or confidential incident details.
3. 3Use data-loss controls for the most sensitive categories, and rotate any secret that has been exposed.